A preliminary relief judge in The Hague has dismissed the claims of three citizens who sought to prevent the Dutch state from renewing its contract with Solvinity. The judge ruled that discontinuing the latter’s management of the national digital identity system is not feasible without unacceptable risks. The reasoning was published yesterday.
The national identity platform, known as DigiD, is managed by Solvinity. Its proposed acquisition by the U.S. company Kyndryl has raised widespread sovereignty concerns, given the extent to which American laws would enable Washington DC to peer into Dutch citizen data.
On May 6, the preliminary relief judge of the District Court of The Hague ruled in preliminary relief proceedings regarding the Solvinity contract. Three citizens demanded that the State not renew the agreement. Incidentally, this does not concern the group of prominent figures who, together with the Privacy First foundation, initiated administrative proceedings against the DigiD takeover. “We do not know exactly who the people behind this preliminary injunction are, nor do we know exactly on what grounds this case is being brought,” said Eric Smit, one of the initiators of the proceedings against the takeover, when the preliminary injunction became known.
That extension had already been approved some time ago. State Secretary Eric van der Burg had granted permission at the end of March, even though the House of Representatives had asked him not to do so. The preliminary injunction was filed on the deadline date.
The plaintiffs fear that Solvinity will soon be acquired by the American company Kyndryl. As a result, the management of the Picard platform—the digital foundation on which the DigiD and MijnOverheid platforms operate—would fall under the scope of U.S. law. The CLOUD Act, FISA, and Executive Order 12333 could, in theory, give U.S. authorities access to data belonging to Dutch citizens. The government itself acknowledged this: there are risks, but they are not yet concrete.
Public interest outweighs other considerations
The judge stated that he was taking a cautious approach, as discretion in the performance of public duties lies with the executive branch. Judicial intervention is justified only in cases of manifestly unlawful conduct. According to the judge, that is not the case here.
The central question is whether an alternative to Solvinity is available. The State argued that a responsible transition would take six to eight months, due to the technical complexity of the Picard platform. The plaintiffs argued that several companies and experts had indicated that a transition would be feasible within a few months. But that claim remained too vague, the judge ruled. Without a contract, the agreement would expire on August 6, 2026, resulting in the failure of essential government services.
In addition, the judge noted that the State is engaged in discussions with Solvinity and Kyndryl to mitigate risks. Those discussions are still ongoing. As long as it is not clear that a secure transition is impossible, there is no basis for accusing the State of unlawful conduct.
The Picard Platform
It is worth taking a moment to consider this Picard platform, where Solvinity manages the IaaS and PaaS. This infrastructure layer consists of various types of storage, containers, VMs, and networks. Solvinity began building the platform in November 2020. In its Final Advisory Opinion on the Logius ICT Infrastructure in 2023, the ICT Assessment Advisory Board noted that several “bottlenecks” emerged during the migration, resulting in a one-year delay. We can therefore state with certainty that the migration path to Solvinity/Picard encountered more friction than initially anticipated. Given this history, the court would logically have been unlikely to be convinced by ambitious deadlines for returning to Solvinity.
Right to terminate remains undecided
The plaintiffs also attempted another route: compelling the State to terminate the agreement as soon as the acquisition by Kyndryl is finalized. This would be possible under Article 30.3 of the ARBIT terms and conditions. That clause permits a “change of control” as grounds for termination. However, the court ruled that the State would likely need Solvinity’s cooperation for this, and that it is unclear whether such cooperation would be forthcoming if the government were to pursue this path. Furthermore, the acquisition is not yet final.
That last point is and remains important. The Investment Screening Bureau (BTI) is still assessing the deal for national security risks. The competition watchdog ACM has already approved the acquisition, but security falls outside its jurisdiction. The House of Representatives previously passed a motion not to renew the contract if the acquisition goes through. The court does not interfere in the political debate, but neither does it impose a direct ban.
The plaintiffs must pay the legal costs of 2,100 euros. Further escalation through a trial on the merits or political pressure on the BTI review remains a possibility.